Reporting to the Manager of Monitoring Global, this role focuses on frontline alert triage, incident support, and continuous improvement of our monitoring processes.We are looking for a solid background in API and cybersecurity experience with either embedded vehicle exposure or a strong aptitude to learn.You will partner across cloud, vehicle, and enterprise teams to help ensure rapid, effective problem resolution for connected vehicles and the cloud services that power them.
-
Operational Monitoring and Incident Response: Perform daily PSOC alert triage and support incident coordination, containment, remediation, recovery, and closure.
-
Cloud & Embedded Investigation and Resolution: Support investigations of security events across cloud application stacks and embedded vehicle architectures using available logging and telemetry.
-
Global Coverage Contribution: Contribute to Ford’s follow-the-sun operating model, executing shift handoffs, and sustaining continuous worldwide coverage.
-
Operational Improvement and Feedback Loop: Surface operational friction points and provide feedback to help improve detection logic, tooling, and response workflows.
-
Cross-Functional Partnership: Collaborate closely with the Cyber Incident Response Team (CIRT), Product Development, and Enterprise IT to execute response playbooks and coordinate complex mitigations.
-
Bachelor’s degree in Computer Science, Cybersecurity, or Engineering, or related field.
-
2+ years in cybersecurity, security operations, or a related technical field.
-
Working understanding of incident response lifecycles, escalation, and incident management practices.
-
Experience with API security and exposure to cloud security operations on one or more major cloud platforms, including logging, monitoring, identity, and response workflows.
-
Embedded vehicle cybersecurity exposure, or a demonstrated aptitude and eagerness to learn.
-
Ability to work effectively in a fast paced 24x7 operations environment, including shift-based coverage.
-
Clear written and verbal communication for documenting incidents and coordinating with technical teams.
